ping_scan_int-ext

Explanation

ping_scan_int-ext is a security event in the Netography Fusion Portal that looks for Internal to External Ping Scans.

What to Look For

If ping_scan_int-ext is triggered, it means that an internal host within your network is attempting to ping external IP addresses. This is a potential sign of an attacker attempting to map out your network and identify potential targets for further exploitation. Look for abnormal ping activity from internal hosts and investigate any suspicious traffic from those hosts. It may also be indicative of an infection, or a misconfiguration in a network scanning or mapping tool.

Related MITRE ATT&CK Categories

Network Service Discovery, Technique T1046 - Enterprise
Active Scanning, Technique T1595 - Enterprise